CVE-2022-47075

CVSS 7.5 HIGHEPSS 59.4%

An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to download sensitive information via the action name parameter to ExportEmployeeDetails.aspx, and to ExportReportingManager.aspx.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

n/a · n/a

public PoCs found — 2

cve_referencepacketstormsecurity.com/files/173093/Smart-Office-Web-20.28-Information-Disclosure-Insecure-Direct-Object-Reference.htmlunverified exploitdbwww.exploit-db.com/exploits/51539unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://packetstormsecurity.com/files/173093/Smart-Office-Web-20.28-Information-Disclosure-Insecure-Direct-Object-Reference.html https://cvewalkthrough.com/smart-office-suite-cve-2022-47076-cve-2022-47075/https://cvewalkthrough.com/smart-office-suite-unauthenticated-data-ex/https://youtu.be/D42upepxzwM